usn-6835-1
Vulnerability from osv_ubuntu
Published
2024-06-17 17:35
Modified
2026-04-27 14:11
Summary
ghostscript vulnerabilities
Details

It was discovered that Ghostscript did not properly restrict eexec seeds to those specified by the Type 1 Font Format standard when SAFER mode is used. An attacker could use this issue to bypass SAFER restrictions and cause unspecified impact. (CVE-2023-52722) This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10.

Thomas Rinsma discovered that Ghostscript did not prevent changes to uniprint device argument strings after SAFER is activated, resulting in a format-string vulnerability. An attacker could possibly use this to execute arbitrary code. (CVE-2024-29510)

Zdenek Hutyra discovered that Ghostscript did not properly perform path reduction when validating paths. An attacker could use this to access file locations outside of those allowed by SAFER policy and possibly execute arbitrary code. (CVE-2024-33869)

Zdenek Hutyra discovered that Ghostscript did not properly check arguments when reducing paths. An attacker could use this to access file locations outside of those allowed by SAFER policy. (CVE-2024-33870)

Zdenek Hutyra discovered that the "Driver" parameter for Ghostscript's "opvp"/"oprp" device allowed specifying the name of an arbitrary dynamic library to load. An attacker could use this to execute arbitrary code. (CVE-2024-33871)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-52722",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-29510",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-33869",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-33870",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-33871",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "ghostscript",
            "binary_version": "9.50~dfsg-5ubuntu4.12"
          },
          {
            "binary_name": "ghostscript-x",
            "binary_version": "9.50~dfsg-5ubuntu4.12"
          },
          {
            "binary_name": "libgs9",
            "binary_version": "9.50~dfsg-5ubuntu4.12"
          },
          {
            "binary_name": "libgs9-common",
            "binary_version": "9.50~dfsg-5ubuntu4.12"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "ghostscript",
        "purl": "pkg:deb/ubuntu/ghostscript@9.50~dfsg-5ubuntu4.12?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.50~dfsg-5ubuntu4.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.27~dfsg+0-0ubuntu3",
        "9.27~dfsg+0-0ubuntu4",
        "9.50~dfsg-5ubuntu1",
        "9.50~dfsg-5ubuntu2",
        "9.50~dfsg-5ubuntu3",
        "9.50~dfsg-5ubuntu4",
        "9.50~dfsg-5ubuntu4.1",
        "9.50~dfsg-5ubuntu4.2",
        "9.50~dfsg-5ubuntu4.3",
        "9.50~dfsg-5ubuntu4.4",
        "9.50~dfsg-5ubuntu4.5",
        "9.50~dfsg-5ubuntu4.6",
        "9.50~dfsg-5ubuntu4.7",
        "9.50~dfsg-5ubuntu4.8",
        "9.50~dfsg-5ubuntu4.9",
        "9.50~dfsg-5ubuntu4.10",
        "9.50~dfsg-5ubuntu4.11"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-52722",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-29510",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-33869",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-33870",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-33871",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "ghostscript",
            "binary_version": "9.55.0~dfsg1-0ubuntu5.7"
          },
          {
            "binary_name": "ghostscript-x",
            "binary_version": "9.55.0~dfsg1-0ubuntu5.7"
          },
          {
            "binary_name": "libgs9",
            "binary_version": "9.55.0~dfsg1-0ubuntu5.7"
          },
          {
            "binary_name": "libgs9-common",
            "binary_version": "9.55.0~dfsg1-0ubuntu5.7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "ghostscript",
        "purl": "pkg:deb/ubuntu/ghostscript@9.55.0~dfsg1-0ubuntu5.7?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.55.0~dfsg1-0ubuntu5.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.54.0~dfsg1-0ubuntu2",
        "9.55.0~dfsg1-0ubuntu4",
        "9.55.0~dfsg1-0ubuntu5",
        "9.55.0~dfsg1-0ubuntu5.1",
        "9.55.0~dfsg1-0ubuntu5.2",
        "9.55.0~dfsg1-0ubuntu5.3",
        "9.55.0~dfsg1-0ubuntu5.4",
        "9.55.0~dfsg1-0ubuntu5.5",
        "9.55.0~dfsg1-0ubuntu5.6"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-29510",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-33869",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-33870",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-33871",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "ghostscript",
            "binary_version": "10.02.1~dfsg1-0ubuntu7.1"
          },
          {
            "binary_name": "libgs-common",
            "binary_version": "10.02.1~dfsg1-0ubuntu7.1"
          },
          {
            "binary_name": "libgs10",
            "binary_version": "10.02.1~dfsg1-0ubuntu7.1"
          },
          {
            "binary_name": "libgs10-common",
            "binary_version": "10.02.1~dfsg1-0ubuntu7.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "ghostscript",
        "purl": "pkg:deb/ubuntu/ghostscript@10.02.1~dfsg1-0ubuntu7.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.02.1~dfsg1-0ubuntu7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.01.2~dfsg1-0ubuntu2",
        "10.01.2~dfsg1-0ubuntu2.1",
        "10.02.1~dfsg1-0ubuntu1",
        "10.02.1~dfsg1-0ubuntu2",
        "10.02.1~dfsg1-0ubuntu5",
        "10.02.1~dfsg1-0ubuntu6",
        "10.02.1~dfsg1-0ubuntu7"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Ghostscript did not properly restrict eexec\nseeds to those specified by the Type 1 Font Format standard when\nSAFER mode is used. An attacker could use this issue to bypass SAFER\nrestrictions and cause unspecified impact. (CVE-2023-52722)\nThis issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10.\n\nThomas Rinsma discovered that Ghostscript did not prevent changes to\nuniprint device argument strings after SAFER is activated, resulting\nin a format-string vulnerability. An attacker could possibly use this\nto execute arbitrary code. (CVE-2024-29510)\n\nZdenek Hutyra discovered that Ghostscript did not properly perform\npath reduction when validating paths. An attacker could use this to\naccess file locations outside of those allowed by SAFER policy and\npossibly execute arbitrary code. (CVE-2024-33869)\n\nZdenek Hutyra discovered that Ghostscript did not properly check\narguments when reducing paths. An attacker could use this to\naccess file locations outside of those allowed by SAFER policy.\n(CVE-2024-33870)\n\nZdenek Hutyra discovered that the \"Driver\" parameter for Ghostscript\u0027s\n\"opvp\"/\"oprp\" device allowed specifying the name of an arbitrary dynamic\nlibrary to load. An attacker could use this to execute arbitrary code.\n(CVE-2024-33871)\n",
  "id": "USN-6835-1",
  "modified": "2026-04-27T14:11:34Z",
  "published": "2024-06-17T17:35:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6835-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52722"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-29510"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-33869"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-33870"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-33871"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "ghostscript vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2023-52722",
    "UBUNTU-CVE-2024-29510",
    "UBUNTU-CVE-2024-33869",
    "UBUNTU-CVE-2024-33870",
    "UBUNTU-CVE-2024-33871"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.